?
Solved

Spanning tree Portfast Bpdugard

Posted on 2016-07-17
15
Medium Priority
?
100 Views
Last Modified: 2016-07-22
I am trying to see the difference in configuring Bpdugard Globally and on specific interfaces
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
-when configured Globally, I do not see any difference, I mean NO  ports go to err-disable status.

Any clarification on BPDGUARD when configured globally ?

Thank you
0
Comment
Question by:jskfan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 2
  • 2
  • +2
15 Comments
 
LVL 11

Assisted Solution

by:Richardson Porto
Richardson Porto earned 132 total points
ID: 41716075
You can enable or disable STP PortFast BPDU guard on a global basis, which affects all ports that have PortFast configured.

Source: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html#topic3
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 132 total points
ID: 41716107
The global BPDUguard and BPDUfilter command only apply to ports which are configured with portfast.
0
 

Author Comment

by:jskfan
ID: 41716197
I did configure on Switch 1 globally spanning tree portfast default  and spanning portfast Bpdugard default

on SW2 I shut down the connected interfaces to Switch 1,   then brought them back up with No Shutdown.
However nothing happen on Switch1. I mean I do not see the ERR-DISABLE  keyword.

Per Port configuration:
I  configured the same thing on Interfaces I get the ERR_DIsable when Switch2 interfaces come back up, but Globally I have not seen that happened.
0
Limited time offer using promo code EXPERTS30

Designed with a wealth of functionality and convenience, ATEN's new Thunderbolt™ 2 Sharing Switch takes your Thunderbolt setup to the next level. Now through September 15, 2017, Experts Exchange members get 30% off the US7220 on the ATEN USA eShop using promo code EXPERTS30.

 
LVL 50

Expert Comment

by:Don Johnston
ID: 41716215
First... Are these real switches or packet tracer or GNS?

If they aren't actual, physical switches, we're done. The simulators and emulators have too many inconsistencies.

Second, if we're talking about actual switches, please post the configs and specify which ports are relevant.
0
 
LVL 9

Expert Comment

by:Ian Arakel
ID: 41717020
Hi there,

There is no difference in functionality of BPDU guard when configured globally or per interface basis.
The transitioning of the port into err-disabled once a BPDU is received on the BPDU guard enabled is the same in both cases.
0
 
LVL 30

Assisted Solution

by:Predrag
Predrag earned 136 total points
ID: 41717585
Note:
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
This is not function of BPDUguard.
BPDU guard puts port into err-disabled state as soon as it receives any BDPU on interface.
Root Guard is the one that matches that description - when superior BDPU is received will place port in root-inconsistent state.
0
 

Author Comment

by:jskfan
ID: 41718058
SW1#sh run
Building configuration...

Current configuration : 1129 bytes
!
! Last configuration change at 01:46:10 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 duplex auto
!
interface Ethernet0/2
 duplex auto
!
interface Ethernet0/3
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 duplex auto
!
interface Ethernet2/1
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window



SW2#sh run
Building configuration...

Current configuration : 1117 bytes
!
! Last configuration change at 01:43:05 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 shutdown
 duplex auto
!
interface Ethernet0/2
 shutdown
 duplex auto
!
interface Ethernet0/3
 shutdown
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 shutdown
 duplex auto
!
interface Ethernet2/1
 shutdown
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 shutdown
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window

STP.JPG
0
 

Author Comment

by:jskfan
ID: 41718060
As shown in the attached file, on SW2 I shut down e0/0 and e2/2 then brings them back up
the e2/2 on SW1 will go through LIST/LRN/FWD
but does not go to Err-Disable state
0
 

Author Comment

by:jskfan
ID: 41718061
stp
0
 

Author Comment

by:jskfan
ID: 41718068
SW1#sh span

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    32769
             Address     aabb.cc00.0100
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0100
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/0               Desg FWD 100       128.1    Shr
Et0/1               Desg FWD 100       128.2    Shr Edge
Et0/2               Desg FWD 100       128.3    Shr Edge
Et0/3               Desg FWD 100       128.4    Shr Edge
Et1/0               Desg FWD 100       128.5    Shr Edge
Et1/1               Desg FWD 100       128.6    Shr Edge
Et1/2               Desg FWD 100       128.7    Shr Edge
Et1/3               Desg FWD 100       128.8    Shr Edge

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------

Et2/0               Desg FWD 100       128.9    Shr Edge
Et2/1               Desg FWD 100       128.10   Shr Edge
Et2/2               Desg FWD 100       128.11   Shr
Et2/3               Desg FWD 100       128.12   Shr Edge

Open in new window


SW1#sh interfaces statu

Port      Name               Status       Vlan       Duplex  Speed Type
Et0/0                        connected    trunk        auto   auto unknown
Et0/1                        connected    1            auto   auto unknown
Et0/2                        connected    1            auto   auto unknown
Et0/3                        connected    1            auto   auto unknown
Et1/0                        connected    1            auto   auto unknown
Et1/1                        connected    1            auto   auto unknown
Et1/2                        connected    1            auto   auto unknown
Et1/3                        connected    1            auto   auto unknown
Et2/0                        connected    1            auto   auto unknown
Et2/1                        connected    1            auto   auto unknown
Et2/2                        connected    trunk        auto   auto unknown
Et2/3                        connected    1            auto   auto unknown
SW1#

Open in new window

0
 
LVL 9

Accepted Solution

by:
Ian Arakel earned 1600 total points
ID: 41718156
Hi there,

This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

Below is fact as per the Cisco documentation:

PortFast BPDU guard prevents loops by moving a nontrunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs instead of putting them into the spanning tree blocking state
0
 

Author Comment

by:jskfan
ID: 41719071
This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

I thought about that last night after I watched youtube video.
I will try it later
0
 

Author Comment

by:jskfan
ID: 41719072
Thank you
0
 

Author Comment

by:jskfan
ID: 41719075
However when I configured BPDUGUARD by Port instead Gloabal...even the ports were Trunk...one of them still went to Err-Disable status
0
 

Author Comment

by:jskfan
ID: 41720064
These are the Findings:
BPDUGUARD (GLOBAL)

LAB example:
on SW2= Shutdown the Port Connecting to SW1

On SW1:
First the Port(s)  facing the Devices that are not supposed to Send BPDUs ; such as computers need to be configured as Access Ports.
Then at the global configuration of the Switch facing the computers, configure with both commands below:

SW1(config)#spanning-tree portfast default
SW1(config)#spanning-tree portfast bpduguard default

on SW2= Type No Shutdown on the Port Connecting to SW1, This will send BPDUs to the access port on SW1 and the port will go into Err-Disable State.
===================================

Per Port

I did not have to configure any port linking SW1 to SW2 as access port , I left them as Trunk
Lab Example
ON SW2: I shutdown the trunk port linking to SW1
On SW1 :
SW1(config-if)#spanning-tree bpduguard enable

Then on SW2, I type No Shutdown on the Trunk port
SW1 port went into err-disable state.
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question